CVE-2022-34592
Published: 07 July 2022
Summary
CVE-2022-34592 is a critical-severity Command Injection (CWE-77) vulnerability in Wavlink Wl-Wn575A3 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Wavlink WL-WN575A3 firmware version RPT75A3.V4300.201217 contains a command injection vulnerability in the obtw function. The flaw, tracked as CVE-2022-34592 and assigned CWE-77, permits unauthenticated attackers to supply arbitrary operating-system commands through a specially crafted POST request. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.
An attacker with network access can send a malicious HTTP POST to the affected device and obtain arbitrary command execution. Successful exploitation grants the ability to read, modify, or delete data and to fully compromise the confidentiality, integrity, and availability of the wireless range extender.
Public references consist of proof-of-concept repositories that document the request format and reproduction steps; no vendor advisory or firmware patch information is included in the supplied references. The EPSS score has reached a peak of 0.1851 with a current value of 0.1800, indicating sustained moderate exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-37544
Vulnerability details
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.